Add support for Access-Control-Expose-Headers

Implemented as the `expose` option, and omitted by default. Fully backwards compatible.